1. Field of the Invention
The present invention relates generally to computer networks, and more particularly to insider threat detection in computer networks.
2. Background Art
In many situations, network and security analysts need to map observed network events to the users that generated them. However, many events produced by devices such as network-based intrusion detection systems (NIDSs) and firewalls only identify the source of the event as an Internet Protocol (IP) address of the originating host. Unfortunately, IP addresses cannot be statically mapped to users within most internal corporate local area networks (LANs). The commonly used Dynamic Host Configuration Protocol (DHCP) dynamically leases IP addresses to hosts on a first-come, first-served basis and for limited durations. In addition, many organizations take advantage of Microsoft Windows Roaming Profiles to permit their mobile users to effectively operate from any workstation. Mapping IP addresses to users is particularly important for insider threat detection, which requires knowledge of the user behind the observed behavior.
Passive fingerprinting allows the identification of the host operating system by observing the TCP/IP protocol and welcome banners associated with well known services (e.g., telnet). More recently, passive fingerprinting has allowed detection of applications running on a host by detecting and analyzing network protocols in use. However, passive fingerprinting does not allow the passive attribution of anonymous network events to their associated users.
What are needed therefore are methods for passively attributing anonymous network events to their associated users.